Merge remote-tracking branch 'qatar/master'

* qatar/master:
  x86: cabac: replace explicit memory references with "m" operands
  avplay: don't request a stereo downmix
  wmapro: use av_float2int()
  lavc: avoid invalid memcpy() in avcodec_default_release_buffer()
  lavu: replace int/float punning functions
  lavfi: install libavfilter/vsrc_buffer.h
  Remove extraneous semicolons
  sdp: Restore the original mp4 format h264 extradata if converted
  rtpenc: Add support for mp4 format h264
  rtpenc: Simplify code by introducing a separate end pointer
  movenc: Use the actual converted sample for RTP hinting
  Fix a bunch of common typos.

Conflicts:
	doc/developer.texi
	doc/eval.texi
	doc/filters.texi
	doc/protocols.texi
	ffmpeg.c
	ffplay.c
	libavcodec/mpegvideo.h
	libavcodec/x86/cabac.h
	libavfilter/Makefile
	libavformat/avformat.h
	libavformat/cafdec.c
	libavformat/flvdec.c
	libavformat/flvenc.c
	libavformat/gxfenc.c
	libavformat/img2.c
	libavformat/movenc.c
	libavformat/mpegts.c
	libavformat/rtpenc_h264.c
	libavformat/utils.c
	libavformat/wtv.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>

1 files changed, 16 insertions, 17 deletions

diff --git a/libavformat/rtpenc_h264.c b/libavformat/rtpenc_h264.c
index 11074d0d51..86930bbac1 100644
--- a/libavformat/rtpenc_h264.c
+++ b/libavformat/rtpenc_h264.c
@@ -33,18 +33,15 @@ static const uint8_t *avc_mp4_find_startcode(const uint8_t *start, const uint8_t
 {
     int res = 0;
 
-    if (end - start < nal_length_size) {
+    if (end - start < nal_length_size)
         return NULL;
-    }
-    while (nal_length_size--) {
+    while (nal_length_size--)
         res = (res << 8) | *start++;
-    }
 
-    if (end - start < res) {
+    if (start + res > end || res < 0 || start + res < start)
         return NULL;
-    }
 
-    return res + start;
+    return start + res;
 }
 
 static void nal_send(AVFormatContext *s1, const uint8_t *buf, int size, int last)
@@ -80,25 +77,27 @@ static void nal_send(AVFormatContext *s1, const uint8_t *buf, int size, int last
 
 void ff_rtp_send_h264(AVFormatContext *s1, const uint8_t *buf1, int size)
 {
-    const uint8_t *r;
+    const uint8_t *r, *end = buf1 + size;
     RTPMuxContext *s = s1->priv_data;
 
     s->timestamp = s->cur_timestamp;
-    r = s->nal_length_size ? (avc_mp4_find_startcode(buf1, buf1 + size, s->nal_length_size) ? buf1 : buf1 + size) : ff_avc_find_startcode(buf1, buf1 + size);
-    while (r < buf1 + size) {
+    if (s->nal_length_size)
+        r = avc_mp4_find_startcode(buf1, end, s->nal_length_size) ? buf1 : end;
+    else
+        r = ff_avc_find_startcode(buf1, end);
+    while (r < end) {
         const uint8_t *r1;
 
         if (s->nal_length_size) {
-            r1 = avc_mp4_find_startcode(r, buf1 + size, s->nal_length_size);
-            if (!r1) {
-                r1 = buf1 + size;
-            }
+            r1 = avc_mp4_find_startcode(r, end, s->nal_length_size);
+            if (!r1)
+                r1 = end;
             r += s->nal_length_size;
         } else {
-            while(!*(r++));
-            r1 = ff_avc_find_startcode(r, buf1 + size);
+            while (!*(r++));
+            r1 = ff_avc_find_startcode(r, end);
         }
-        nal_send(s1, r, r1 - r, (r1 == buf1 + size));
+        nal_send(s1, r, r1 - r, r1 == end);
         r = r1;
     }
 }